How SynthID and C2PA Content Credentials Work
Two different techniques are used to mark AI-generated content. C2PA Content Credentials attach a cryptographically signed provenance record to a file, while SynthID hides a watermark inside the image, audio, video or text itself. This explainer follows each mechanism and sets them side by side.
Checked against C2PA Technical Specification 2.3 (December 2025), Google DeepMind's SynthID page and the SynthID-Text paper in Nature (2024)
- C2PA: a signed manifest, stored as metadata with the asset
- SynthID: a pattern mixed into the content itself
As of (C2PA specification 2.3)All entries as stated by the spec or by Google
| Attribute | C2PA Content Credentials | SynthID: images, video, audio | SynthID-Text | Figure |
|---|---|---|---|---|
| What it is | An open technical specification for a signed provenance record, called a manifest, stored with an asset1 | An imperceptible watermark embedded in AI-generated images, video and audio2 | A generative watermark for text from a large language model, applied as the model picks each next token4 | Vendor-stated |
| Where the signal lives | In metadata: the manifest sits in the asset's Content Credential, optionally backed by soft bindings1 | In the content itself, added at the moment the content is created2 | In the choice of words: a statistical signature spread across the tokens4 | Vendor-stated |
| How it is checked | A validator checks the signature and the signer's credential, then each assertion; trust rests on the signer's identity and the C2PA trust lists1 | Upload to Google's SynthID Detector, or ask Gemini, Search or Chrome, which check for a SynthID watermark23 | Score the text against the watermarking key; detection needs no access to the language model, and longer texts give more evidence4 | Vendor-stated |
| What it can show | Who signed a claim and what it says about how the asset was made and changed; the specification does not judge whether provenance is "good" or "bad"1 | That the content was generated or altered by Google AI or a partner that uses SynthID2 | That the text was likely produced by a watermarked model; the authors say it is not a complete solution to AI-text detection4 | Vendor-stated |
| Edits and removal | Tamper-evident: hard-binding hashes let a validator detect changed content. A manifest can be separated from its asset when metadata is removed or corrupted; soft bindings such as fingerprints or invisible watermarks exist to recover it1 | Google says it is designed to stand up to cropping, filters, frame-rate changes and lossy compression2 | Evidence grows with text length, and is weak when the model's output has low entropy, that is, when it almost always gives the same response4 | Vendor-stated |
| Who has to apply it | A claim generator such as a camera, app or AI tool signs the manifest; adoption is opt-in1 | The generating system; Google says partners include OpenAI, NVIDIA and Kakao, and soon Apple2 | The service running the model, at generation time; the paper notes this requires coordination between the actors that run text-generation services4 | Vendor-stated |
| Version and date | Specification 2.3, December 2025: adds live video streaming, embedding in text files and fine-grained watermarking actions1 | SynthID Detector announced May 20, 2025; Google said over 10 billion pieces of content had been watermarked by then3 | Nature paper published Oct 23, 2024; a live test on about 20 million Gemini responses found no significant change in user feedback4 | Vendor-stated |
A side-by-side of the open C2PA specification and Google's SynthID watermarks, from the specification, Google DeepMind's own pages and the peer-reviewed SynthID-Text paper. Claims about SynthID's robustness and scale are Google's and are not independently tested here. Other vendors' marking methods are not covered. Figure labels: how they work.
How it works
Two different problems
A person who finds an image online can ask two questions: where did it come from, and was it made by an AI system? C2PA, the Coalition for Content Provenance and Authenticity, addresses the first with a technical specification for "a secure, tamper-evident and standardized way" to carry information about how an asset was created and changed.1 SynthID, Google's watermarking technology, addresses the second: it "embeds digital watermarks directly into AI-generated images, audio, text or video" that people can't perceive but a detector can find.2
C2PA: assertions, claim, signature
A C2PA record is built in layers. Statements about the asset, such as how it was created, what edits were made or which camera captured it, are called assertions. They are wrapped into a claim, which a hardware or software "claim generator" digitally signs, and the whole bundle is a manifest; the set of manifests stored with an asset is its Content Credential.1 Each time the asset is changed, the existing provenance is preserved and the new change is added to it.1
The specification's own example is a photo taken with a C2PA-enabled camera: the camera creates a manifest with information about itself, a thumbnail and cryptographic hashes that bind the photo to the manifest, signs it, and embeds it in the JPEG.1
Hard and soft bindings
A manifest only means something if it is tied to the right content. A hard binding is one or more cryptographic hashes that uniquely identify the asset or part of it, so a validator can tell if the content has changed.1 A soft binding is a content identifier that is "not statistically unique, such as a fingerprint", or is an invisible watermark embedded in the content.1 The reason for soft bindings is practical: the specification notes an asset can lose its manifest "due to removal or corruption of asset metadata", and a fingerprint or watermark can be used to look the manifest up again in a manifest repository.1 A Content Credential with such a soft binding is called "durable".1 This is where the two techniques meet: version 2.3 of the specification added fine-grained actions for recording watermarking.1
What C2PA does and doesn't prove
C2PA's trust model rests on the identity of the signer: a validator checks the claim signature, the signer's credential and each assertion, and shows the result to the user.1 Certificates come from trust anchors on a C2PA-managed trust list.1 The specification says it does not judge whether a set of provenance data is "good" or "bad", only whether the assertions "can be validated as associated with the underlying asset, correctly formed, and free from tampering".1 A valid credential therefore shows who signed what, not that the content is true.1
SynthID in images, video and audio
For images and video, Google says SynthID adds an invisible watermark at the moment of creation, without changing quality, and that it is designed to stand up to cropping, filters, changed frame rates and lossy compression.2 For audio, it watermarks content from Google's Lyria music model and NotebookLM's podcast feature.2 Detection happens through Google's SynthID Detector portal and through Gemini, Search and Chrome; Google says the portal now checks content from Google and partners including OpenAI, NVIDIA and Kakao, and soon Apple.2 At the portal's May 2025 announcement Google said over 10 billion pieces of content had been watermarked.3 These are Google's statements about its own system.
SynthID-Text: marking the choice of words
A language model writes text one token at a time, assigning each candidate a probability. SynthID-Text is a "generative watermark": it changes how the next token is sampled, using a hash of the last few tokens and a watermarking key, so the output carries a statistical signature.4 Its Tournament sampling picks tokens through a series of pairwise contests scored by pseudorandom functions seeded from that hash; detection scores the text and needs no access to the model.4 The authors report that it did not change quality in a live experiment on about 20 million Gemini responses.4
The limits are stated in the paper. Longer text carries more evidence, and a watermark is weaker when the model's output has little entropy, since there is little choice among tokens to bias.4 The authors also say generative watermarks "do not offer a complete solution to artificial-intelligence text detection", partly because they depend on the services that run the model applying the watermark.4
Which to use when
The two are complements, not competitors. A signed credential can carry detailed, human-readable history but depends on metadata surviving; a watermark travels inside the content but can only say what its generator embedded, and only that generator's detector can read it. Neither is a general-purpose AI detector. This post covers only the mechanisms, not which vendors apply them.
Sources
- C2PA, C2PA Technical Specification 2.3 (December 2025), retrieved 2026-10-20.
- Google DeepMind, Google SynthID, retrieved 2026-10-20.
- Google, SynthID Detector: a new portal to help identify AI-generated content, May 20, 2025, retrieved 2026-10-20.
- Dathathri, S. et al., Scalable watermarking for identifying large language model outputs, Nature, published Oct 23, 2024, retrieved 2026-10-20.